EveryAILaw.com

Requirements at a glance

This regulation imposes 20 specific requirements for Transparency & Disclosure across 2 provisions:

• Interaction disclosure — Providers must design systems intended to interact directly with natural persons so those persons are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person (Article 50(1))
• Synthetic content marking — Providers of systems, including general-purpose AI systems, generating synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account content-specific limitations, implementation costs and the generally acknowledged state of the art (Article 50(2))
• Emotion recognition and biometric categorisation notice — Deployers must inform natural persons exposed to emotion recognition or biometric categorisation systems of their operation (Article 50(3))
• Deepfake disclosure — Deployers generating or manipulating image, audio or video constituting a deepfake must disclose that the content is artificially generated or manipulated (Article 50(4))
• Public-interest text disclosure — Deployers of systems generating or manipulating text published to inform the public on matters of public interest must disclose its artificial generation or manipulation. This does not apply where the use is authorised for specified criminal-law purposes, or where human review or editorial control occurs and a natural or legal person holds editorial responsibility (Article 50(4))
• Disclosure timing and accessibility — Information under Article 50(1)-(4) must be clear and distinguishable, provided by the first interaction or exposure, and conform to applicable accessibility requirements (Article 50(5))
• Disclosure exceptions — Article 50(1) excepts certain law-authorised criminal-law systems unless available for public crime reporting; Article 50(2) excepts limited assistive editing or insubstantial changes and certain law-authorised criminal-law uses; Article 50(3) excepts certain permitted criminal-law uses. Article 50(4) excepts law-authorised criminal-law uses; for deepfakes forming part of an evidently artistic, creative, satirical, fictional or analogous work or programme, disclosure remains required but is limited to an appropriate statement of the existence of generated or manipulated content that does not hamper the work's display or enjoyment (Article 50(1)-(4))
• Generative AI grace period — Providers of systems, including general-purpose AI systems, generating synthetic audio, image, video or text that were placed on the market before 2026-08-02 must take the necessary steps to comply with Article 50(2) by 2026-12-02. This transition concerns Article 50(2), not the other disclosure duties (Article 111(4), inserted by Regulation (EU) 2026/1744)
• Marking codes of practice — The Commission facilitates Union-level codes of practice for detection, marking and labelling of AI-generated or manipulated content, assesses their adequacy for Article 50(2) and (4), and may impose common rules by implementing act if a code is inadequate (Article 50(7), as replaced by Regulation (EU) 2026/1744)
• Operational transparency — High-risk systems must be designed and developed so their operation is sufficiently transparent to enable deployers to interpret output and use it appropriately (Article 13(1))
• Instructions for use — High-risk systems must be accompanied by instructions for use in an appropriate digital format or otherwise, containing concise, complete, correct and clear information relevant, accessible and comprehensible to deployers (Article 13(2))
• Provider identity — Instructions must state the identity and contact details of the provider and, where applicable, its authorised representative (Article 13(3)(a))
• Capabilities and limitations — Instructions must state intended purpose, the accuracy, robustness and cybersecurity metrics the system was validated against, foreseeable circumstances affecting those levels, and risks arising under intended use or reasonably foreseeable misuse (Article 13(3)(b))
• Explainability information — Where applicable, instructions must describe technical capabilities to provide information explaining the system's output (Article 13(3)(b)(iv))
• Group performance and input data — Where appropriate, instructions must state performance regarding specific persons or groups, and input-data specifications or relevant information about training, validation and testing datasets (Article 13(3)(b)(v)-(vi))
• Output interpretation — Where applicable, instructions must provide information enabling deployers to interpret the system's output and use it appropriately (Article 13(3)(b)(vii))
• Human oversight measures — Instructions must describe the human oversight measures built in under Article 14, including technical measures facilitating output interpretation by deployers (Article 13(3)(d))
• Pre-determined changes — Where applicable, instructions must describe the changes to the system and its performance which the provider pre-determined at the moment of the initial conformity assessment (Article 13(3)(c))
• Resources, lifetime and maintenance — Instructions must state computational and hardware resources needed, expected lifetime, and any necessary maintenance and care measures, including their frequency and software updates (Article 13(3)(e))
• Logging mechanisms — Where relevant, instructions must describe mechanisms enabling deployers to collect, store and interpret logs under Article 12 (Article 13(3)(f))